Arstrat io newsletter

'A huge issue'

Newsnight spoke to Sir John Scarlett about the nature of the cyber threat.

He was head of MI6 from 2004 to 2009, and chairman of the Cabinet Office Joint Intelligence Committee before that.

Earlier this month, Sir John became chairman of the Bletchley Park Trust.

In his first television interview since that appointment, he told us that Bletchley Park, and its famous wartime codebreaking success, held a special place in the history of cyberwarfare.

"Bletchley Park is at the very centre of this whole issue. In the Second World War, this was a state-to-state matter, and it was states grappling with each other… and so all the issues around cyber communications and their vulnerability were in that context.

"It was super secret. It didn't impact on people's everyday lives, and the whole issue of cyber communications, or machine communications didn't impact on people's everyday lives. Now it's into everything and everybody is affected by it.

"We have to worry about crime, we have to worry about terrorism, we have to worry about state activity, and we have to worry about what's called hacktivists…people with missions of one kind or another."

There seems little doubt in his mind that what he calls the "state-to-state issue", and the threat from the most capable states in this area, "remains a huge issue"

'Virtual peacekeeping force'

John Bumgarner, from the US Cyber Consequences Unit in Washington, would agree. His research organisation describes him as an "uber-hacker" with 18 years of service in special operations and intelligence.

He goes further. He told Newsnight there will soon be a need for a virtual UN peacekeeping force - in cyberspace.

"We've seen cyber incidents between Russia and Georgia, and that's ongoing. We've seen incidents between Pakistan and India and that's ongoing. We've seen stuff between China and India... between Israel and other Middle Eastern states. The UN needs to figure out how they can deploy peace keepers in the digital borders of a nation, virtual peacekeepers that would protect the peace."

Sir John thinks the cyber threat is growing by definition because use of the internet is growing. But he sees this as more than a purely military domain.

"There's quite a lot of talk about cyber warfare, and cyber attacks as if this is a military issue. Of course there are military aspects to it and military infrastructure aspects to it, and in the event of some future state-to-state conflict undoubtedly this would be a huge feature. But in the immediate term this is something which is happening now, the attacks and the downloading and the theft and the invasion of privacy are happening now on a day-by-day basis."

Computer security company Sophos confirms that the scale of attacks is growing, significantly.

Its teams constantly monitor computers infected with malicious code - often designed to send out Spam designed to trick users into giving away personal information that's valuable to organised crime. The company sells software to protect against such attacks.

"Here at Sophos we see 180,000 new pieces of "malware", that's malicious code, every single day. That compares with 1500 a day when I joined Sophos 6 years ago," said Mark Harris, VP SophosLabs & Global Engineering Operations.

'Cyber law'

And there are complaints that our laws are struggling to keep pace.

Stewart Room of Field Fisher Waterhouse said there was now a need for an amnesty - instead of punishment - for companies that suffered a data loss or cyber-attack.

An amnesty, he argued, would help to encourage companies to come forward and discuss what went wrong - so that others could learn, fast.

He is also calling for a new "cyber law", to formalise best practice.

"A good idea within legislation would be to introduce a requirement that companies need to state in their annual reports exactly what they've done to protect our security and our information that year. In the same way that annual reports contain statements about environmental issues such as CO2 emissions. If we were to deal with security in that way, shareholders would engage with the matter and so would the public generally and that would improve security."

Headlines about cyber attacks pop up almost daily now. One of the most startling was the attack on the global intelligence firm Stratfor over Christmas, for which members of the loose-knit hacker group Anonymous claimed responsibility.

John Bumgarner analysed the data released for the Guardian newspaper and concluded that thousands of British email addresses and passwords - including those of defence, intelligence and police officials as well as politicians and Nato advisers - had been revealed.

Mr Bumgarner chuckled when we asked if the Stratfor release might dent people's confidence in the ability of even the most security-conscious of organisations to keep data safe.

"We're taking it on blind faith... really when you give your information out as a private citizen to a corporation you're praying that that corporation will protect your data... as much as possible, but they can only do so much."

This week, the Republican presidential hopeful Newt Gingrich has been citing cyberwar on the campaign trail, reportedly saying that the appropriate response to countries that target US corporate or government information systems is to "create a level of pain which teaches people not to do it".

But how far can we trust what we're being told about the scale of the threat? I asked Sir John why anyone should take seriously his warnings about the threats to cyber security, given the track record - some might say failings - of British intelligence on Iraqi weapons of mass destruction.

"I think people have to judge what's being said here, make their judgements, apply their commons sense, and then just think it through and say: Well, is this a serious and believable and realistic issue, or is it not?"

At this week's London conference, delegates were reassured that technology would allow us to adapt to the cyber threat.

"We once thought of Aids as an existential threat, now we live with it," Major General Jonathan Shaw, commander of UK Cyber Policy at the Ministry of Defence told the audience.

"Our reaction today is similarly out of balance…. we're never going to cure it, we have to live with it… But how much intellectual property will we have left by the time we get it right?"

Table of Contents

The Strategic Communication of Unmanned Warfare

By Matt Armstrong, MountainRunner, June 2008

Modern conflict is increasingly a struggle for strategic influence above territory. This struggle is, at its essence, a battle over perceptions and narratives within a psychological terrain under the influence of local and global pressures. One of the unspoken lessons embedded in the Counterinsurgency Manual (FM3-24) is that we risk strategic success relying on a lawyerly conduct of war that rests on finely tuned arguments of why and why not. When too much defense and too much offense can be detrimental, we must consider the impact of our actions, the information effects. The propaganda of the deed must match the propaganda of the word.

Giulio Douhet wrote in 1928,

“A man who wants to make a good instrument must first have a precise understanding of what the instrument is to be used for; and he who intends to build a good instrument of war must first ask himself what the next war will be like.”

Secretary of Defense Robert M. Gates has said that there is too much spending geared toward the wrong way of war. I find this to be particularly true in area of battlefield robots. Much (if not all) of the unmanned systems planning and discussion, especially with regards to unmanned ground combat vehicles, is not taking into account the nature of the next war, let alone the current conflict.

Last year I posted an unscientific survey that explored how a ground combat robot operating away from humans (remote controlled or autonomous) might shape the opinions of the local host family. The survey also explored the propaganda value of these systems to the enemy, in the media markets of our allies, Muslim countries, and here in the United States. The survey results weren’t surprising.

Serviam Magazine just published what could be construed as an executive summary of a larger paper of mine to be published by Proteus later this year. That paper is about four times longer and adds a few points with more details. In the meantime, my article that appeared in Serviam, Combat Robots and Perception Management, is below.

Also of interest: Unintended Consequences of Armed Robots in Modern Conflict and, for a different kind of unmanned warfare, see For Official Secret Squirrel Use Only: the ACORN

Combat Robots and Perception Management by Matt Armstrong (the below article originally appeared in the magazine Serviam and is based on a paper and presentation I gave at the U.S. Army War College):

Robots will figure prominently in the future of warfare, whether we like it or not. They will provide perimeter security, logistics, surveillance, explosive ordinance disposal, and more because they fit strategic, operational, and tactical requirements for both the irregular and “traditional” warfare of the future. While American policymakers have finally realized that the so-called “war on terror” is a war of ideas and a war of information, virtually all reports on unmanned systems ignore the substantial impact that “warbots” will have on strategic communications, from public diplomacy to psychological operations. It is imperative that the U.S. military and civilian leadership discuss, anticipate, and plan for each robot to be a real strategic corporal (or “strategic captain,” if you consider their role as a coordinating hub).

As unmanned systems mature, ground systems operating among and interacting with foreign populations will substantially affect perceptions of our mission, both at home and abroad. Robots will exert significant influence in three overlapping information domains. The first domain is the change on the calculus of foreign engagement as the public, Congress, and future administrations perceive a reduction in the human cost of war (on our side). The second domain is the psychological struggle of the local populations in conflict and postconflict zones, and the third is the overarching global information environment.

The first domain and the most touted benefit of robots is their ability to reduce the exposure and vulnerability of America’s warfighters. The Defense Department’s Unmanned Systems Roadmap 2007-2032, approved in December 2007, leads with this point and repeatedly emphasizes it. Unlike President Clinton’s lobbing cruise missiles against Al-Qaeda in Sudan and Afghanistan, a future president will be able to deploy remote-controlled and autonomous robots to accomplish the same mission with greater precision. However, few have considered the true cost of lowering the bar for kinetic action in a world of instant communications. There are parallels here between outsourcing to machines and outsourcing to private military contractors that circumvent public and congressional oversight by avoiding the use of uniformed soldiers.

The second critical domain is in the psychological struggle for the minds and hearts of the men and women in conflict and postconflict zones. There is a real risk of undoing the lessons learned on the importance of personal contact with local populations that was earned at such a high price in Iraq and Afghanistan. Mapping the human terrain becomes, by implication at least, not only unnecessary but impossible in the sterility of robot-human interfaces.

In 2007, Lieutenant General Raymond Odierno issued guidance emphasizing the importance of engaging the local population and building a “feel” for the street. This guidance instructed Coalition forces to “get out and walk” and noted that an up-armored Humvee limits “situational awareness and insulates us from the Iraqi people we intend to secure.” Criticism of mine-resistant ambush-protected vehicles that prevent local engagement are just as applicable to robots operating in the sea of the people.

If deployments are not accompanied by intelligent and constant two-way conversations with the people and the media, the propaganda about our deeds becomes how the United States is not willing to risk lives for the mission or the host population. The media must not create the idea that the mission is not important enough to sacrifice our own men and women, lest the local population wonder why they should sacrifice theirs. The result may be more than replaying improvised explosive device attacks against robots on YouTube; it may lead to a modern propaganda contest and an escalation of spectacular attacks to reach humans in order to influence U.S. public opinion and increase extraregional sympathy for the insurgents.

The third domain is the discourse in the global media, both formal and informal, with foes and their base, allies, “swing voters,” and our own public. This discourse includes not only justifying actions but also containing and managing failures. On the former, work is under way today to formulate rules of engagement for robots designed around Western notions of an ethical practice of war codified in the laws of war. But the collapse of traditional concepts of time and space by new media prevents consideration of information by consumers and reporters. The noble pursuit of “lawfare,” of knowing the truth through careful reflection and analysis to validate Western-justified ends and means, just does not work. Attempting to justify acts based on what can be done according to Western laws actually permits an engagement model that is too permissive and ultimately detrimental to a mission where, as Lieutenant General James Mattis put it, “ideas are more important than [artillery] rounds.” In other words, international law may permit firing into a house with women and children, but the blowback will be significant. Further, if private military contractors are perceived as skirting the laws of war, then the application of those laws to a robot and its human handler (if one exists) is even more unclear.

Without capable information management from the strategic to the tactical level, accidents and failures of unmanned systems will receive harsh treatment in the global media, amplifying an endemic view in the Middle East and elsewhere that the United States commoditizes death. The United States cannot afford technological failures or induced failures (i.e., hacking) that kill civilians. The U.S. military can blame “out-of-control” human contractors, even if they were operating under the rules of engagement set by their government clients, but the principal is absolved from responsibility to a much lesser degree if the agent is a machine. Previous incidents of “technical failure” causing civilian deaths, including the USS Vincennes shootdown of Iran Air Flight 655 in 1988, are examples of a strategic communications apparatus that cannot handle technical failure.

It is essential that the information effects of what we do be considered from the outset, including the impact of information campaigns. Strategic communicators, public diplomats, and information operators must be involved from the inception of unmanned warfare, but they are not. Conversations with proponents of unmanned systems in the Defense Department and think-tanks make it clear the U.S. military has yet to understand that deploying robots to augment the human warfighter is not the same as changing out the M-16 for the M-4 carbine. The uniformed warfighters the robots will replace reflect the country’s commitment to the mission, shaping local and global opinions that garner or destroy support for the mission. Robots, regardless of their real or perceived autonomy, will also represent, reflect, and shape these opinions. The informational effect of robots is substantial, but little research has been done on the subject. Failing to recognize the effect that unmanned systems may have on the struggle for the minds and wills of men and women will have tragic unintended consequences.

Table of Contents

57% Believe a Cyber Arms Race is Currently Taking Place, Reveals McAfee-Sponsored Cyber Defense Report

By the Security & Defence Agenda (SDA), MarketWatch, 30 Jan 2012

BRUSSELS & WASHINGTON, Jan 30, 2012 (BUSINESS WIRE) -- McAfee and the Security & Defence Agenda (SDA) today revealed the findings from a report; Cyber-security: The Vexed Question of Global Rules that paints, for the first time, a global snapshot of current thinking about the cyber-threat and the measures that should be taken to defend against them, and assesses the way ahead. The SDA, the leading defense and security think-tank in Brussels, interviewed leading global security experts to ensure that findings would offer usable recommendations and actions. The report was created to identify key debate areas and trends and to help to governments and organizations understand how their cyber defense posture compares to those of other countries and organizations.

Here are some noted findings:

-- 57% of global experts believe that an arms race is taking place in cyber space.

-- 36% believe cyber-security is more important than missile defense.

-- 43% identified damage or disruption to critical infrastructure as the greatest single threat posed by cyber-attacks with wide economic consequences (up from 37% in McAfee's 2010 Critical Infrastructure Report).

-- 45% of respondents believe that cyber-security is as important as border security.

-- The state of cyber-readiness of the United States, Australia, UK, China and Germany all ranked behind smaller countries such as Israel, Sweden and Finland (23 countries ranked in report).

McAfee asked the SDA, as an independent think-tank, to produce the most informed report on global cyber defense available. The SDA had in-depth interviews with some 80 world-leading policy-makers and cyber-security experts in government, business and academia in 27 countries and anonymously surveyed 250 world leaders in 35 countries. As the only specialist security and defense think-tank in Brussels, SDA has become one of the world's leading forums for the discussion of international defense and security policies. The methodology used for rating various countries' state of cyber-readiness is that developed by Robert Lentz, President of Cyber Security Strategies and former Deputy Assistant Secretary of Defense for Cyber, Identity and Information Assurance. [see here for infographic on rankings]

Top 6 Actions Cited in Report

-- Real-time global information sharing required

-- Financial incentives for critical improvements in security for both private and public sectors

-- Give more power to law enforcement to combat cross-border cyber crime

-- Best practice-led international security standards need to be developed

-- Diplomatic challenges facing global cyber treaties need to be addressed

-- Public awareness campaigns that go beyond current programs to help citizens

Real-time sharing of global intelligence was a core recommendation of the report, citing the building of trust between industry stakeholders by setting up bodies to share information and best practices, like the Common Assurance Maturity Model (CAMM) and the Cloud Security Alliance (CSA). "The core problem is that the cyber criminal has greater agility, given large funding streams and no legal boundaries to sharing information, and can thus choreograph well-orchestrated attacks into systems," says Phyllis Schneck, Vice President and Chief Technology Officer, Global Public Sector, McAfee. "Until we can pool our data and equip our people and machines with intelligence, we are playing chess with only half the pieces."

Experts interviewed also agreed that developments like smart phones and cloud computing mean we are seeing a whole new set of problems linked to inter-connectivity and sovereignty that require new regulations and new thinking. Last year, McAfee issued a Q3 threat report that stated that the total amount of malware targeted at Android devices jumped 76 percent from Q2 of 2010 to Q2 of last year, to become the most attacked mobile operating system.

Other key report findings from the SDA report include the following:

-- Need to address expected shortage of cyber workforce: More than half (56%) of the respondents highlight a coming skills shortage.

-- Low level of preparedness for cyber attacks: China, Russia, Italy and Poland fall behind Finland, Israel, Sweden, Denmark, Estonia, France, Germany, Netherlands, UK, Spain and the United States.

-- Cyber-security exercises are not receiving strong participation from industry: Although almost everyone believes that exercises are important, only 20% of those surveyed in the private sector have taken part in such exercises.

-- Risk assessment: Prioritize information protection, knowing that no one size fits all. The three key goals that need to be achieved are confidentiality, integration and availability in different doses according to the situation.

-- Balance between security and privacy: Improve attribution capability by selectively reducing anonymity without sacrificing the privacy rights.

While many respondents believed that global treaties were an essential factor in the development of sound policy, some also suggested the establishment of cyber-confidence building measures as alternatives to global treaties, or as a stopgap measure, since treaties are seen as unverifiable, unenforceable and impractical. Stewart Barker, the former Assistant Secretary of Homeland Security under President George W. Bush, stated that treaties "delude western countries into thinking they have some protection against tactics that have been unilaterally abandoned by other treaty signatories."

About the report:

McAfee asked the Security & Defence Agenda (SDA) as an independent think-tank to produce the most extensive report on Cyber Defense. The report stack ranks the degree to which governments are prepared to withstand cyber attacks. This SDA report sets out to reflect the many different views on what cyber-security means, and how to move towards it. To build up a multi-faceted picture of opinion worldwide, SDA interviewed world leaders to highlight what they see as the key issues.

To download "The Cyber Defense Report" report please visit www.mcafee.com/

Table of Contents

In Battle for Hearts and Minds, Taliban Turn To CDs

By Ahmad Shafi, NPR, January 23, 2012

January 23, 2012 When the Taliban controlled Afghanistan from 1996 to 2001, their hard-line policies included a ban on music tapes and videos.

Yet now, the Taliban are producing their own CDs in an attempt to win the hearts and minds of Afghans.

In bustling downtown Kabul, Mustafa, 22, works in an electronics store selling music CDs to 20-something customers.

But not all of Mustafa's customers are looking for the latest Afghan, Indian or Western pop songs. He says he has customers who only look for Taliban songs — a sort of hypnotic chanting of religious and nationalistic poems unaccompanied by music. He clicks on one the audio files.

In Pashto, one of the two main languages of Afghanistan, the song calls for a holy war against the "infidels." Its says the fight will continue until corruption is wiped out and the Taliban's version of Islamic law is restored.

Mustafa says someone brings him the Taliban CDs that he suspects have probably been downloaded from the Internet. He sells 50 songs for about a dollar.

Since 2005, the Taliban have been mass producing CDs and DVDs featuring footage of alleged NATO atrocities and clips of insurgents battling NATO forces.

The CDs and DVDs are readily available in Kabul and other major cities. In some rural areas, the Taliban operate pirate radio transmitters, with the militants broadcasting warnings to local residents and Afghan government officials.